Overview
overview
10Static
static
10XClient.exe
windows7-x64
10XClient.exe
windows10-1703-x64
10XClient.exe
windows10-2004-x64
10XClient.exe
windows11-21h2-x64
10XClient.exe
macos-10.15-amd64
1XClient.exe
macos-10.15-amd64
4XClient.exe
ubuntu-18.04-amd64
XClient.exe
debian-9-armhf
XClient.exe
debian-9-mips
XClient.exe
debian-9-mipsel
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 20:59
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win11-20240730-en
Behavioral task
behavioral5
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
XClient.exe
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral8
Sample
XClient.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral9
Sample
XClient.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral10
Sample
XClient.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
XClient.exe
-
Size
80KB
-
MD5
bfa950b37b6a4f8de71af861e677a8b4
-
SHA1
2ee40bfbf2964d92c82256e5924169295dfdd225
-
SHA256
07f94f8f6061ba95899914496edc5854aa810de56797d9004875276d60e21ade
-
SHA512
235b514fac01b24edaef3aeb4209676789b6ba9264a8798cb7ae48c26d2455cdd8f254e92bbba688535acb69fd77b3c0a0a549cf97ece84c235cc74f72234e1a
-
SSDEEP
1536:EI5NuEGJkEtydWqZQSp1eS+b59gxzhfxdl/5m6qeo//3Oy/4IK4Dax5:Eg1GhtktQGAS+b59cJ4eA/OlINDab
Malware Config
Extracted
xworm
full-self.gl.at.ply.gg:45212
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2780-1-0x0000000001330000-0x000000000134A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 1944 powershell.exe 2804 powershell.exe 2888 powershell.exe 2708 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeXClient.exepid process 1944 powershell.exe 2804 powershell.exe 2888 powershell.exe 2708 powershell.exe 2780 XClient.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
XClient.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2780 XClient.exe Token: SeDebugPrivilege 1944 powershell.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 2888 powershell.exe Token: SeDebugPrivilege 2708 powershell.exe Token: SeDebugPrivilege 2780 XClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XClient.exepid process 2780 XClient.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
XClient.exedescription pid process target process PID 2780 wrote to memory of 1944 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 1944 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 1944 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2804 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2804 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2804 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2888 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2888 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2888 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2708 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2708 2780 XClient.exe powershell.exe PID 2780 wrote to memory of 2708 2780 XClient.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD584f858b39efd6d72ff2b2f6475188902
SHA15e3195fb7ca488e9e95cc5a01932c757c671b80b
SHA256d3c1c34530ebbd51b8d5e3a1efd758154cfe6e0acafac49998b9ae30b6ebe90c
SHA512ac793dc4e62cd2b4693b09c618c87b908d89c74ba5067bddde5656798331f3b816cfec1305f4f50b701fc2193fd51cd0ac041c43fd42669ebe2b84f938f4b0cd
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1944-6-0x00000000027D0000-0x0000000002850000-memory.dmpFilesize
512KB
-
memory/1944-7-0x000000001B400000-0x000000001B6E2000-memory.dmpFilesize
2.9MB
-
memory/1944-8-0x0000000002A70000-0x0000000002A78000-memory.dmpFilesize
32KB
-
memory/2780-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmpFilesize
4KB
-
memory/2780-1-0x0000000001330000-0x000000000134A000-memory.dmpFilesize
104KB
-
memory/2780-28-0x000000001B4D0000-0x000000001B550000-memory.dmpFilesize
512KB
-
memory/2780-29-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmpFilesize
4KB
-
memory/2780-30-0x000000001B4D0000-0x000000001B550000-memory.dmpFilesize
512KB
-
memory/2804-14-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/2804-15-0x0000000000460000-0x0000000000468000-memory.dmpFilesize
32KB